FAT workstation convergence: architecture freeze and canonical shell staging

IoListTestingWindow.EmbeddedEngineeringHost.cs

@@ -28,6 +28,21 @@ internal static void RegisterEmbeddedEngineeringFatHost()
             handledEventsToo: true);
     }
 
+    internal void PrepareForEmbeddedEngineeringHost()
+    {
+        // WPF refuses Window.Show() when ShowActivated=false while WindowState=Maximized.
+        // The production FAT XAML historically starts maximized, therefore normalize the
+        // invisible donor BEFORE Show(). Its exact center is re-parented into MainWindow on
+        // Loaded; the donor itself never needs a maximized native HWND.
+        WindowState = WindowState.Normal;
+        ShowActivated = false;
+        ShowInTaskbar = false;
+        Opacity = 0d;
+        WindowStartupLocation = WindowStartupLocation.Manual;
+        Left = -32000d;
+        Top = -32000d;
+    }
+
     private static void EmbeddedEngineeringFatHost_Loaded(object sender, RoutedEventArgs e)
     {
         if (sender is not IoListTestingWindow window ||
@@ -45,9 +60,7 @@ window.Owner is not MainWindow owner ||
         // MainWindow's legacy launcher still calls Show() on this Window. Make that bootstrap
         // surface invisible immediately; the actual production visual is moved into Engineering
         // on the next Loaded-priority dispatcher turn, before ContextIdle command-panel work.
-        window.ShowActivated = false;
-        window.ShowInTaskbar = false;
-        window.Opacity = 0d;
+        window.PrepareForEmbeddedEngineeringHost();
 
         window.Dispatcher.BeginInvoke(
             DispatcherPriority.Loaded,
@@ -64,24 +77,30 @@ private void TryMountIntoEngineering(MainWindow owner)
         {
             EnsureProductionFatPresentationForEmbeddedHost();
             DisableLegacyEmbeddedCommandPanel();
-            var surface = DetachProductionFatCentralWorkspace();
-            if (surface == null)
-                return;
+            var surface = DetachProductionFatCentralWorkspace()
+                          ?? throw new InvalidOperationException("Production FAT center could not be detached from its donor window.");
 
             _engineeringEmbeddedSurface = surface;
             _engineeringEmbeddedMounted = owner.MountProductionFatWorkspace(this, surface);
             if (!_engineeringEmbeddedMounted)
-                return;
+                throw new InvalidOperationException("Engineering FAT host rejected the production workspace surface.");
 
             // The central FAT view now belongs to MainWindow. Keep this Window loaded and
             // hidden because existing controller/session/event code is intentionally reused.
             Hide();
         }
         catch (Exception ex)
         {
+            // Never leave an invisible off-screen donor as a silent blank FAT failure.
+            // Restore the historical standalone presentation so the operator has a usable
+            // production FAT surface and a visible diagnostic if embedding itself fails.
+            WindowState = WindowState.Maximized;
             Opacity = 1d;
             ShowInTaskbar = true;
             ShowActivated = true;
+            WindowStartupLocation = WindowStartupLocation.CenterOwner;
+            Left = double.NaN;
+            Top = double.NaN;
             MessageBox.Show(
                 owner,
                 $"ARSAS could not embed the production FAT workspace. The standalone FAT window will remain available.\n\n{ex.Message}",
@@ -190,22 +209,51 @@ private void DisableLegacyEmbeddedCommandPanel()
 
     internal void SelectEngineeringDeviceForEmbeddedFat(Iec61850MonitorDevice? device)
     {
-        if (!_engineeringEmbeddedMounted || device == null)
+        if (!_engineeringEmbeddedMounted)
             return;
 
-        var match = Project.Ieds.FirstOrDefault(ied =>
-            (!string.IsNullOrWhiteSpace(ied.LiveDeviceId) &&
-             ied.LiveDeviceId.Equals(device.DeviceId, StringComparison.OrdinalIgnoreCase)) ||
-            (!string.IsNullOrWhiteSpace(ied.IpAddress) &&
-             ied.IpAddress.Equals(device.IpAddress, StringComparison.OrdinalIgnoreCase)) ||
-            ied.IedName.Equals(device.SclIedName, StringComparison.OrdinalIgnoreCase) ||
-            ied.IedName.Equals(device.Name, StringComparison.OrdinalIgnoreCase));
-        if (match == null || ReferenceEquals(SelectedIed, match))
+        // M3 viewed-device contract: the persistent Engineering IED Explorer owns
+        // what the FAT grid displays. SelectedIed/Session.SelectContext changes only that
+        // projection; an active capture remains latched inside its per-IED controller.
+        // Clearing the Explorer selection or selecting an IED outside this FAT projection
+        // must clear the FAT view instead of silently leaving the previous IED on screen.
+        if (device == null)
+        {
+            if (CanSelectIed)
+                SelectedIed = null;
             return;
+        }
+
+        // Resolve by strongest Engineering identity first. Do not use one OR predicate:
+        // a weak fallback on an earlier project row must never beat an exact live DeviceId.
+        var match = Project.Ieds.FirstOrDefault(_ => false);
+        if (!string.IsNullOrWhiteSpace(device.DeviceId))
+        {
+            match = Project.Ieds.FirstOrDefault(ied =>
+                !string.IsNullOrWhiteSpace(ied.LiveDeviceId) &&
+                ied.LiveDeviceId.Equals(device.DeviceId, StringComparison.OrdinalIgnoreCase));
+        }
+
+        if (match == null && !string.IsNullOrWhiteSpace(device.SclIedName))
+        {
+            match = Project.Ieds.FirstOrDefault(ied =>
+                ied.IedName.Equals(device.SclIedName, StringComparison.OrdinalIgnoreCase));
+        }
+
+        if (match == null && !string.IsNullOrWhiteSpace(device.Name))
+        {
+            match = Project.Ieds.FirstOrDefault(ied =>
+                ied.IedName.Equals(device.Name, StringComparison.OrdinalIgnoreCase));
+        }
+
+        if (match == null && !string.IsNullOrWhiteSpace(device.IpAddress))
+        {
+            match = Project.Ieds.FirstOrDefault(ied =>
+                !string.IsNullOrWhiteSpace(ied.IpAddress) &&
+                ied.IpAddress.Equals(device.IpAddress, StringComparison.OrdinalIgnoreCase));
+        }
 
-        // Do not retarget an active production FAT transaction/session. When idle, the
-        // persistent Engineering IED Explorer is the navigation/selection authority.
-        if (!CanSelectIed)
+        if (ReferenceEquals(SelectedIed, match) || !CanSelectIed)
             return;
 
         SelectedIed = match;

IoListTestingWindow.xaml.cs

@@ -119,18 +119,28 @@ private void SetAddingFatIeds(bool value)
 
     private async void StartSession_Click(object sender, RoutedEventArgs e)
     {
-        var selectedIed = SelectedIed;
-        if (selectedIed?.IsPreparing == true)
+        // M4 freezes both the IED owner and exact evidence scope before any asynchronous
+        // Engineering preparation. Explorer navigation may continue, but it cannot redirect
+        // this transaction or silently widen the production capture scope.
+        var requestedIed = SelectedIed;
+        if (requestedIed?.IsPreparing == true)
             return;
 
-        var preflight = IoTestSessionPreflight.Validate(selectedIed);
-        if (!preflight.Succeeded)
+        IoFatCaptureTargetLease captureLease;
+        try
+        {
+            captureLease = IoFatProductionControllerAdapter.LatchStartTarget(Project, requestedIed);
+        }
+        catch (InvalidOperationException ex)
         {
-            ShowActionResult(preflight, "FAT session scope is not ready");
+            ShowActionResult(
+                IoTestSessionActionResult.Failure(ex.Message),
+                "FAT session scope is not ready");
             return;
         }
 
-        PreparationStatusText = $"Connecting {selectedIed!.IedName} · {selectedIed.IpAddress}:102";
+        var selectedIed = captureLease.Ied;
+        PreparationStatusText = $"Connecting {selectedIed.IedName} · {selectedIed.IpAddress}:102";
         RaisePreparationProperties();
         try
         {
@@ -155,7 +165,10 @@ private async void StartSession_Click(object sender, RoutedEventArgs e)
                 }
             }
 
-            var result = Session.Start(selectedIed);
+            // Revalidate the frozen identity/configuration only after Engineering has
+            // completed connection preparation. The adapter delegates to the unchanged
+            // production session controller, which remains the sole evidence writer.
+            var result = IoFatProductionControllerAdapter.StartLatched(Project, Session, captureLease);
             ShowActionResult(result, "FAT evidence session could not start");
             RaiseStatusProperties();
             if (result.Succeeded)
@@ -187,23 +200,28 @@ private async void StartSession_Click(object sender, RoutedEventArgs e)
 
     private void PauseSession_Click(object sender, RoutedEventArgs e)
     {
-        var result = Session.Pause();
+        var targetIed = SelectedIed;
+        var result = Session.Pause(targetIed);
         ShowActionResult(result, "FAT session could not pause");
         if (result.Succeeded)
             Storage?.SaveNow();
     }
 
     private void ResumeSession_Click(object sender, RoutedEventArgs e)
     {
-        var result = Session.Resume();
+        // Continue is explicitly IED-targeted. A later Explorer change cannot make the
+        // production controller rebind this active evidence session to another device.
+        var targetIed = SelectedIed;
+        var result = Session.Resume(targetIed);
         ShowActionResult(result, "FAT session could not resume");
         if (result.Succeeded)
             Storage?.ScheduleSave();
     }
 
     private void StopSession_Click(object sender, RoutedEventArgs e)
     {
-        var result = Session.Stop();
+        var targetIed = SelectedIed;
+        var result = Session.Stop(targetIed);
         ShowActionResult(result, "FAT session could not stop");
         if (result.Succeeded)
             Storage?.SaveNow();

MainWindow.IoTesting.cs

@@ -494,6 +494,8 @@ private Task ShowIoTestingWorkspaceAsync(IoTestWorkspaceLaunchResult launch, int
         var controller = launch.Session;
         var persistence = launch.Workspace;
         var window = new IoListTestingWindow(launch.Project, controller, persistence) { Owner = this };
+        if (ProductionFatTabReady)
+            window.PrepareForEmbeddedEngineeringHost();
         RegisterLoadedIoFatWindow(window);
         _activeIoTestSessionController = controller;
         Interlocked.Exchange(ref _ioTestObservationSequence, DateTime.UtcNow.Ticks);
@@ -525,7 +527,8 @@ void WindowClosed(object? sender, EventArgs args)
         }
 
         window.Closed += WindowClosed;
-        Hide();
+        if (!ProductionFatTabReady)
+            Hide();
         window.Show();
         return Task.CompletedTask;
     }